What this error mean peer notification (Invalid-ID-information)

[#1]

Hello, I got this error ipsec 37124 negotiate IPsec phase 1 error status=negotiate_error error_reason=peer notification peer_notif=INVALID-ID-INFORMATION anyone please know what is the wrong exactly??

[willem]

Either you don' t send peer information in your phase1 and the other side needs it, or you receive peer information from the other side and you don' t accept it. Check with the other party that the local id you set in your phase1 equals the peer id they use and vice versa.

[#3]

pls check the phase-1 configuration on both side..it most likely a configuration issue.. http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=fortigate-ipsec-40-mr1pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=12139510&stateId=0%200%2012141074

[#4]

my Peer config is , - Accept any peer ID - Enable IPsec Interface Mode --> Disabled - Local Gateway IP =Main Interface IP in the other side .. CISCO PIX crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto map outside_map 10 match address outside_cryptomap_10 crypto map outside_map 10 set connection-type bi-directional Crypto map outside_map 10 set peer (fortigate ip) Crypto map outside_map 10 set transform-set ESP-3DES-SHA crypto map outside_map 10 set security-association lifetime seconds 28800 crypto map outside_map 10 set security-association lifetime kilobytes 4608000 crypto map outside_map 10 set phase1-mode main crypto map outside_map interface outside

[ede_pfau]

so the Cisco side expects the fortigate IP as peer ID...put it in your phase1 config, " local ID" . Hopefully the IP is static...

[#6]

Do you mean to put the Cisco IP on the (Local ID - Option) ? If yes ,I tried but I got the same error , the IP is fixed Note Crypto map outside_map 10 set peer (fortigate ip) = Crypto map outside_map 10 set peer 41.32.55.5 41.32.55.5 = the real IP of Fortigate (wan1)

[ede_pfau]

no I meant the other way around...if the fortigate IP is set on the Cisco side, then you configure the Fortigate phase1 localID to be the same so that the FG can show it during negotiations. The Cisco IP is mentioned nowhere - no deal.

[#8]

I put the Fortigate real IP on the LocalID & still got the same error 1 2010-11-30 15:19:53 notice ipsec 37134 delete_phase1_sa delete IPsec phase 1 SA 2 2010-11-30 15:19:53 error ipsec 37124 negotiate IPsec phase 1 error negotiate_error 3 2010-11-30 15:19:53 notice ipsec 37129 negotiate progress IPsec phase 2 success 4 2010-11-30 15:19:53 notice ipsec 37127 negotiate progress IPsec phase 1 success 5 2010-11-30 15:19:52 notice ipsec 37127 negotiate progress IPsec phase 1 success 6 2010-11-30 15:19:52 notice ipsec 37127 negotiate progress IPsec phase 1 success 7 2010-11-30 15:19:52 notice ipsec 37127 negotiate progress IPsec phase 1

[ede_pfau]

hmm?? that a lot of " success" , now for phase2 as well. So you' re advancing. Any more hints on what might be wrong? Is the policy right? Any setting on phase1 that doesn' t match, like lifetimes or DHgroup?